oauthlint-rules 0.2.6 → 0.3.1

package/dist/schema.d.ts

@@ -81,6 +81,16 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     patterns: z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
     fix: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodObject<{
+        include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }, {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    }>>;
     mode: z.ZodOptional<z.ZodEnum<["search", "taint"]>>;
     'pattern-sources': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
     'pattern-sinks': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
@@ -109,6 +119,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -137,6 +151,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -165,6 +183,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -193,6 +215,10 @@ export declare const RuleSchema: z.ZodEffects<z.ZodObject<{
     'pattern-either-regex'?: string[] | undefined;
     patterns?: unknown[] | undefined;
     fix?: string | undefined;
+    paths?: {
+        include?: string[] | undefined;
+        exclude?: string[] | undefined;
+    } | undefined;
     mode?: "search" | "taint" | undefined;
     'pattern-sources'?: unknown[] | undefined;
     'pattern-sinks'?: unknown[] | undefined;
@@ -242,6 +268,16 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex': z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         patterns: z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
         fix: z.ZodOptional<z.ZodString>;
+        paths: z.ZodOptional<z.ZodObject<{
+            include: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            exclude: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        }, {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        }>>;
         mode: z.ZodOptional<z.ZodEnum<["search", "taint"]>>;
         'pattern-sources': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
         'pattern-sinks': z.ZodOptional<z.ZodArray<z.ZodType<unknown, z.ZodTypeDef, unknown>, "many">>;
@@ -270,6 +306,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -298,6 +338,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -326,6 +370,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -354,6 +402,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -384,6 +436,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;
@@ -414,6 +470,10 @@ export declare const RuleFileSchema: z.ZodObject<{
         'pattern-either-regex'?: string[] | undefined;
         patterns?: unknown[] | undefined;
         fix?: string | undefined;
+        paths?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+        } | undefined;
         mode?: "search" | "taint" | undefined;
         'pattern-sources'?: unknown[] | undefined;
         'pattern-sinks'?: unknown[] | undefined;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAUxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,cAAc,yCAAuC,CAAC;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAqBxE,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CpB,CAAC;AAEJ,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schema.js

@@ -32,6 +32,16 @@ export const OAuthLintMetadataSchema = z.object({
  * Semgrep accepts many shapes; we only validate the fields we rely on.
  */
 const PatternEntrySchema = z.lazy(() => z.union([z.string(), z.record(z.string(), z.unknown()), z.array(PatternEntrySchema)]));
+/**
+ * Semgrep `paths:` filter. Lets a rule scope itself to (or away from) files by
+ * glob. We use `exclude` to keep production-grant rules from firing on test,
+ * example, vendored, or generated code — locations that should never carry a
+ * real application's OAuth misuse. Passed straight through to Semgrep.
+ */
+const PathsSchema = z.object({
+    include: z.array(z.string()).optional(),
+    exclude: z.array(z.string()).optional(),
+});
 export const RuleSchema = z
     .object({
     // auth.<category>.<name> for the JS/TS pack; language packs prepend a
@@ -53,6 +63,8 @@ export const RuleSchema = z
     'pattern-either-regex': z.array(z.string()).optional(),
     patterns: z.array(PatternEntrySchema).optional(),
     fix: z.string().optional(),
+    // Scope a rule to/away from files by glob (passed through to Semgrep).
+    paths: PathsSchema.optional(),
     // Taint-mode rules (Semgrep dataflow).
     mode: z.enum(['search', 'taint']).optional(),
     'pattern-sources': z.array(PatternEntrySchema).optional(),

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,yEAAyE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;QACrE,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/B,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,kBAAkB,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACtF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,sEAAsE;IACtE,iFAAiF;IACjF,qEAAqE;IACrE,0EAA0E;IAC1E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAClF,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,wCAAwC,CAAC;IACrE,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACxD,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uEAAuE;IACvE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,uCAAuC;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC5D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,OAAO,KAAK,SAAS;IAC1B,IAAI,CAAC,gBAAgB,CAAC,KAAK,SAAS;IACpC,IAAI,CAAC,QAAQ,KAAK,SAAS;IAC3B,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS;IACnC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS;IAC1C,qEAAqE;IACrE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,SAAS;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,EACxC;IACE,OAAO,EACL,6IAA6I;CAChJ,CACF,CAAC;AAIJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.2.6",
+  "version": "0.3.1",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/cookie/no-httponly.yml

@@ -39,7 +39,11 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, httpOnly: true })'
+    # No autofix. As with `auth.cookie.no-secure`, a single rule-level `fix:`
+    # cannot cover all three matched shapes safely: a spread template corrupts
+    # the 2-arg form (unbound `$OPTS` is emitted literally) and does not resolve
+    # an explicit `httpOnly: false`. Inserting a missing key is not a clean
+    # literal replacement, so this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-002
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-httponly

package/rules/cookie/no-samesite.yml

@@ -41,7 +41,11 @@ rules:
                     - pattern: "{..., sameSite: 'None', ...}"
                     - pattern: '{..., sameSite: "None", ...}'
                 - pattern-not: '{..., secure: true, ...}'
-    fix: "$RES.cookie($NAME, $VAL, { ...$OPTS, sameSite: 'strict' })"
+    # No autofix. The correct `SameSite` value is context-dependent — `Strict`
+    # suits most auth flows but breaks OAuth callbacks, which need `Lax`, while a
+    # cookie deliberately set cross-site needs `None` plus `Secure`. The tool
+    # cannot know which, and a spread template would also corrupt the 2-arg form
+    # (unbound `$OPTS`). So this rule deliberately ships no `fix:`.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-003
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-samesite

package/rules/cookie/no-secure.yml

@@ -39,11 +39,14 @@ rules:
           - metavariable-regex:
               metavariable: $NAME
               regex: ^(['"])(?:[a-zA-Z0-9_-]*(?:session|sid|sess|auth|token|jwt|refresh|access)[a-zA-Z0-9_-]*)\1$
-    # Auto-fix applies to the first (3-arg) pattern: spread the existing
-    # options object and inject secure:true. Verbose but always-correct;
-    # users can run prettier afterwards. The 2-arg branch is left alone
-    # because rewriting it requires inserting a brand-new argument.
-    fix: '$RES.cookie($NAME, $VAL, { ...$OPTS, secure: true })'
+    # No autofix. A single rule-level `fix:` cannot be made safe here: this rule
+    # matches three shapes — an options object missing `secure`, the 2-arg form
+    # with no options object at all, and an explicit `secure: false`. A spread
+    # template like `{ ...$OPTS, secure: true }` corrupts the 2-arg form (`$OPTS`
+    # is unbound, so Semgrep emits the literal text `$OPTS`) and leaves an
+    # explicit `secure: false` key in place (the finding re-fires). Inserting a
+    # brand-new argument/key is not a clean literal replacement, so we ship no
+    # `fix:` rather than a rewrite that can break source.
     metadata:
       oauthlint-rule-id: AUTH-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/cookie-no-secure

package/rules/cookie/samesite-none-insecure.yml

@@ -4,6 +4,28 @@ rules:
       - javascript
       - typescript
     severity: WARNING
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. In particular this skips vendored third-party cookie
+    # serializers (e.g. packages/core/src/lib/vendored/cookie.ts) whose
+    # incremental `"; SameSite=None"` attribute fragment is not a complete
+    # insecure cookie. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       A cookie is being set with `SameSite=None` but WITHOUT `Secure`.
       `SameSite=None` *requires* `Secure`: modern browsers reject a

package/rules/flow/oauth-credential-in-log.yml

@@ -0,0 +1,97 @@
+rules:
+  - id: auth.flow.oauth-credential-in-log
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`console.*` or `logger.*`). Logs are written to
+      files, shipped to aggregators (Datadog, Splunk, CloudWatch) and read by
+      people and systems that should never see live credentials. A leaked
+      authorization code or token can be replayed to impersonate the user or
+      complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging
+      (`token.slice(0, 4) + '…'`), log a non-sensitive identifier instead
+      (a user id, a key id), or drop the field entirely.
+    # Taint mode so indirection is caught — `const at = req.query.access_token;
+    # logger.info(at)` flags, not just the inline `console.log(req.query.code)`
+    # form. Distinct from auth.flow.secret-in-log (a search-mode rule keyed on
+    # the NAME of the logged identifier): this is a dataflow rule keyed on the
+    # request SOURCE, so it fires even when the credential is carried through an
+    # arbitrarily-named intermediate variable. The source list is narrowed to
+    # OAuth/OIDC credential fields (and the Authorization header), so logging a
+    # benign request field such as `req.query.page` does not fire. Routing the
+    # value through a redaction/masking helper or a truncating slice clears the
+    # taint.
+    mode: taint
+    pattern-sources:
+      # Dotted accessor: req.query.code / req.body.access_token / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query.$K
+              - pattern: $REQ.body.$K
+              - pattern: $REQ.params.$K
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^(?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)$
+      # Index accessor: req.query['id_token'] / req.body["code"] / …
+      - patterns:
+          - pattern-either:
+              - pattern: $REQ.query[$K]
+              - pattern: $REQ.body[$K]
+              - pattern: $REQ.params[$K]
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^["'](?:code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)["']$
+      # Raw Authorization header (carries the bearer token / basic credentials).
+      - pattern: $REQ.headers.authorization
+      - pattern: $REQ.headers['authorization']
+      - pattern: $REQ.headers["authorization"]
+      - pattern: $REQ.get('authorization')
+      - pattern: $REQ.get('Authorization')
+      - pattern: $REQ.header('authorization')
+      - pattern: $REQ.header('Authorization')
+    pattern-sanitizers:
+      # Redaction / masking helpers, or a truncating slice/substring — the value
+      # that reaches the log is no longer the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+      - pattern: $S.slice(...)
+      - pattern: $S.substring(...)
+      - pattern: $S.substr(...)
+    pattern-sinks:
+      # console.log/info/debug/warn/error(...) — any tainted argument fires.
+      - patterns:
+          - pattern-either:
+              - pattern: console.log(...)
+              - pattern: console.info(...)
+              - pattern: console.debug(...)
+              - pattern: console.warn(...)
+              - pattern: console.error(...)
+      # logger.<level>(...) — a log-named receiver with a log-level method.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(?:ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(?:log|info|debug|warn|warning|error|trace|fatal|verbose|silly)$
+    metadata:
+      oauthlint-rule-id: AUTH-FLOW-013
+      oauthlint-doc-url: https://oauthlint.dev/rules/flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - express
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/flow/open-redirect.yml

@@ -61,6 +61,17 @@ rules:
               - pattern: "$RES.setHeader('Location', $SINK)"
               - pattern: '$RES.setHeader("Location", $SINK)'
               - pattern: "$RES.writeHead($S, {..., Location: $SINK, ...})"
+          # `$RES.redirect(...)` / `$RES.location(...)` also match a bare,
+          # receiver-less `redirect(...)` / `location(...)` call. Those are the
+          # framework navigation primitives exported by Next.js
+          # (`next/navigation`), SvelteKit and Remix — they send the user to a
+          # server-constructed application URL, not the Express `res.redirect`
+          # open-redirect sink this rule targets. Requiring an explicit receiver
+          # removes that over-match (the dominant FP class seen on next-auth)
+          # without affecting any `res.redirect` / `res.location` detection.
+          - pattern-not: redirect($SINK)
+          - pattern-not: redirect($CODE, $SINK)
+          - pattern-not: location($SINK)
           - focus-metavariable: $SINK
     metadata:
       oauthlint-rule-id: AUTH-FLOW-010

package/rules/flow/ssrf.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       Untrusted request input flows into the URL of an outbound HTTP request.
       Because the destination is attacker-controlled, this is a Server-Side

package/rules/flow/timing-unsafe-compare.yml

@@ -4,6 +4,25 @@ rules:
       - javascript
       - typescript
     severity: WARNING
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/tests/**` / `**/fixtures/**`
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/apps/**"
+        - "**/docs/**"
+        - "**/__mocks__/**"
+        - "**/mocks/**"
+        - "**/vendored/**"
+        - "**/node_modules/**"
+        - "**/*.stories.*"
     message: |
       A secret-shaped value (`password`, `token`, `secret`, `apiKey`,
       `csrf`, `hmac`) is being compared with `===` / `!==` /

package/rules/go/cookie/insecure.yml

@@ -14,13 +14,22 @@ rules:
       Set `Secure: true` and `HttpOnly: true` on auth cookies, and add an
       appropriate `SameSite` mode (for example `SameSite: http.SameSiteLaxMode`).
     # Matches only the literal `false`. `Secure: true`, `HttpOnly: true`, and
-    # the absence of the field are not flagged. Works for `http.Cookie{...}`
-    # and `&http.Cookie{...}` (the composite literal matches inside the
-    # address-of).
+    # the absence of the field are not flagged. The `pattern-inside` keeps
+    # detection scoped to an `http.Cookie{...}` (and `&http.Cookie{...}`)
+    # composite literal, so an unrelated struct exposing a `Secure`/`HttpOnly`
+    # bool is never matched. `$FIELD` captures the offending field name so the
+    # narrow match — and the autofix below — targets just that field.
     patterns:
-      - pattern-either:
-          - pattern: 'http.Cookie{..., Secure: false, ...}'
-          - pattern: 'http.Cookie{..., HttpOnly: false, ...}'
+      - pattern-inside: 'http.Cookie{...}'
+      - pattern: '$FIELD: false'
+      - metavariable-regex:
+          metavariable: $FIELD
+          regex: ^(Secure|HttpOnly)$
+    # Safe, deterministic autofix: flip the disabled flag to `true`. `$FIELD` is
+    # preserved, so `Secure: false` becomes `Secure: true` and `HttpOnly: false`
+    # becomes `HttpOnly: true` — each the secure value that resolves the finding,
+    # with every other field in the literal left untouched.
+    fix: '$FIELD: true'
     metadata:
       oauthlint-rule-id: AUTH-GO-COOKIE-001
       oauthlint-doc-url: https://oauthlint.dev/rules/go-cookie-insecure

package/rules/go/flow/oauth-credential-in-log.yml

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.go.flow.oauth-credential-in-log
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      An OAuth/OIDC credential taken from the HTTP request — an authorization
+      `code`, an `access_token` / `refresh_token` / `id_token`, a bearer
+      `token`, a `client_secret`, or the raw `Authorization` header — flows
+      into a logging call (`log.*`, `slog.*`, `fmt.Print*`, or a `logger.*`
+      method). Logs are written to files, shipped to aggregators (Datadog,
+      Splunk, CloudWatch) and read by people and systems that should never see
+      live credentials. A leaked authorization code or token can be replayed
+      to impersonate the user or complete the OAuth exchange (CWE-532).
+
+      Never log the raw credential. Redact or mask it before logging, log a
+      non-sensitive identifier instead (a user id, a key id), or drop the
+      field entirely.
+    # Taint mode so indirection is caught — `at := r.FormValue("access_token");
+    # log.Println(at)` flags, not just the inline form. The source list is
+    # narrowed to OAuth/OIDC credential field names (and the Authorization
+    # header), so logging a benign request field such as `r.FormValue("page")`
+    # does not fire. Routing the value through a redaction/masking helper clears
+    # the taint.
+    mode: taint
+    pattern-sources:
+      # Request getters keyed by a credential-looking parameter name.
+      - patterns:
+          - pattern-either:
+              - pattern: $R.URL.Query().Get($K)
+              - pattern: $R.FormValue($K)
+              - pattern: $R.PostFormValue($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"(code|access[_-]?token|accesstoken|refresh[_-]?token|refreshtoken|id[_-]?token|idtoken|token|client[_-]?secret|clientsecret)"$
+      # The raw Authorization header carries the bearer / basic credential.
+      - patterns:
+          - pattern: $R.Header.Get($K)
+          - metavariable-regex:
+              metavariable: $K
+              regex: (?i)^"authorization"$
+    pattern-sanitizers:
+      # Redaction / masking helpers — the value reaching the log is no longer
+      # the live credential.
+      - pattern: redact(...)
+      - pattern: mask(...)
+      - pattern: maskToken(...)
+    pattern-sinks:
+      # Standard library log / slog / fmt print sinks — any tainted argument.
+      - patterns:
+          - pattern-either:
+              - pattern: log.Print(...)
+              - pattern: log.Printf(...)
+              - pattern: log.Println(...)
+              - pattern: log.Fatal(...)
+              - pattern: log.Fatalf(...)
+              - pattern: log.Fatalln(...)
+              - pattern: log.Panic(...)
+              - pattern: log.Panicf(...)
+              - pattern: slog.Info(...)
+              - pattern: slog.Debug(...)
+              - pattern: slog.Warn(...)
+              - pattern: slog.Error(...)
+              - pattern: fmt.Print(...)
+              - pattern: fmt.Printf(...)
+              - pattern: fmt.Println(...)
+      # A log-named receiver with a log-level method: logger.Info(...),
+      # myLog.Printf(...). The receiver-name constraint keeps this off
+      # unrelated method calls.
+      - patterns:
+          - pattern: $LOG.$LEVEL(...)
+          - metavariable-regex:
+              metavariable: $LOG
+              regex: (?i)^.*log(ger)?$
+          - metavariable-regex:
+              metavariable: $LEVEL
+              regex: ^(Print|Printf|Println|Info|Infof|Infow|Debug|Debugf|Debugw|Warn|Warnf|Warning|Error|Errorf|Errorw|Fatal|Fatalf|Panic|Panicf|Trace|Tracef)$
+    metadata:
+      oauthlint-rule-id: AUTH-GO-FLOW-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-flow-oauth-credential-in-log
+      category: security
+      cwe: CWE-532
+      owasp: API8:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - net/http
+      references:
+        - https://cwe.mitre.org/data/definitions/532.html
+        - https://datatracker.ietf.org/doc/html/rfc6749#section-10.3
+        - https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/

package/rules/go/jwt/untrusted-verify-key.yml

@@ -0,0 +1,68 @@
+rules:
+  - id: auth.go.jwt.untrusted-verify-key
+    languages:
+      - go
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the verification key returned by a
+      `golang-jwt` `Keyfunc` (or into the `WithValidMethods` allowlist). When
+      the attacker controls the key, they sign their own forged token and
+      supply the matching key, so every token "verifies" — a complete
+      authentication bypass. When the attacker controls the accepted methods,
+      they can downgrade verification and defeat the signature check (CWE-347,
+      Improper Verification of Cryptographic Signature).
+
+      The verification key and the accepted algorithms must be fixed
+      server-side. Return the key from trusted configuration or a vetted key
+      set keyed by a validated `kid`, and pin accepted methods to a constant
+      allowlist — never resolve them from `r.URL.Query()`, `r.FormValue`, or a
+      request header.
+    # Taint mode. The source is request input; the sink is the value RETURNED
+    # from a keyfunc (focused on the key expression, not the token) or the
+    # argument to `jwt.WithValidMethods`. Focusing on the key/methods — never
+    # the token, which is supposed to come from the request — keeps this from
+    # firing on every correct call. Distinct from auth.go.jwt.unchecked-method
+    # (a keyfunc that skips the `token.Method` check): this is about a
+    # request-CONTROLLED key or method list. Routing the value through an
+    # allow-list / validation helper clears the taint.
+    mode: taint
+    pattern-sources:
+      - pattern: $R.URL.Query().Get(...)
+      - pattern: $R.URL.Query()[$K]
+      - pattern: $R.FormValue(...)
+      - pattern: $R.PostFormValue(...)
+      - pattern: $R.Header.Get(...)
+      - pattern: $R.PathValue(...)
+    pattern-sanitizers:
+      - pattern: isAllowedKey(...)
+      - pattern: validateKey(...)
+      - pattern: isAllowedAlgorithm(...)
+      - pattern: validateAlgorithm(...)
+    pattern-sinks:
+      # The key returned from a golang-jwt Keyfunc literal. Scoped with
+      # pattern-inside so only a keyfunc return is a sink, and focused on the
+      # returned key expression so the token argument is never the trigger.
+      - patterns:
+          - pattern-inside: |
+              func($T *jwt.Token) ($RET, error) {
+                ...
+              }
+          - pattern: return $SINK, $E
+          - focus-metavariable: $SINK
+      # Request input used as the accepted signing methods.
+      - patterns:
+          - pattern: jwt.WithValidMethods($SINK)
+          - focus-metavariable: $SINK
+    metadata:
+      oauthlint-rule-id: AUTH-GO-JWT-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/go-jwt-untrusted-verify-key
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: LOW
+      technology:
+        - golang-jwt
+      references:
+        - https://cwe.mitre.org/data/definitions/347.html
+        - https://pkg.go.dev/github.com/golang-jwt/jwt/v5#Keyfunc
+        - https://datatracker.ietf.org/doc/html/rfc7518#section-3.1